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1. A method for controlling access, use and distribution of personal data of a user 
stored in a personal data repository; the method comprising the steps of: 

allowing a user to indicate which portions of the personal data stored in the personal 
data repository are releasable to a second party; 

reaching an agreement, between the user and the second party, regarding use, by the 
second party, of any portions of the personal data in the personal data repository; and 

releasing any of the portions of the stored personal data in the personal data repository 
to the second party according to the agreement, wherein 

the agreement includes what items within the personal data repository can be used by 
the second party, and 

only ones of the items which, according to the agreement, can be used by the second 
party are released to the second party. 

2. The method of claim 1, wherein the personal data about the user is collected 
automatically. 

3. The method of claim 1, wherein the step of reaching the agreement comprises 
choosing an agreement provided by an independent agreement provider, wherein the 
independent agreement provider receives compensation based on use of the provided 
agreement. 

4. The method of claim 1, wherein the personal data about the user is entered by the 

user. 

5. The method of claim 1, further comprising the step of storing the personal data 
about the user on a device operated by the user. 
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6. The method of claim 1, farther comprising the step of storing the personal data 
about the user on a trusted party device. 

7. The method of claim 1, farther comprising the step of storing the personal data 
about the user in a distributed manner among a plurality of trusted party devices. 

8. The method of claim 1, further comprising the step of allowing the user to perform 
at least one of adding, deleting or changing the personal data about the user. 

9. The method of claim 1, farther comprising the step of defining a service profile 
within the personal data repository, wherein the service profile includes portions of the 
personal data of the user and information regarding conditions under which items within the 
service profile can be used by the second party. 

10. The method of claim 9, wherein the service profile includes information 
regarding a date and a time that any of the stored information about the user was released to 
the second party and to whom the stored information was released.. 

11. The method of claim 9", wherein the service profile includes information 
pertaining to a description of the agreement between the user and the second party. 

12. The method of claim 1, further comprising the step of acting, by a trusted party, 
as an agent of the user to negotiate use, by the second party, of any of the personal data of the 
user in return for compensation to the user for the use of any of the personal data. 

13. The method of claim 1, further comprising the steps of recording a history of 
actions, by the user using a user device, as part of the personal data of the user. 
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14. The method of claim 13, further comprising defining, by the user, of a level of a 
type of the actions to be recorded, 

15. The method of claim 1, further comprising the steps of: 

receiving, at a trusted party device connected to a computer network, a first request 
from a device operated by a user; 

forming a second request from the first request, the second request being stripped of 
information that can associate the user with the second request; 

sending, from the trusted party device, the second request over a computer network to 
a second party device; 

receiving, at the trusted party device, response information in response to the sending 
of the second request; 

forming a response based on the response information; and 

sending the response to the device operated by the user. 

16. A method for selectively sending information, comprising the steps of: 
receiving, by a trusted party device, a request to send information; 

selecting a user device to receive the information based on a willingness to receive the 
information indicated within the stored personal data about the user when at least one user 
device has indicated the willingness to receive the information; and 

sending the vendor information to the selected user device when the selected user 
device exists. 

17. A method of controlling receipt of information, comprising the steps of: 
receiving, by a user device from a second party device, a request for at least some of 

the personal data of the user; 

attempting to reach an agreement with a second party, via the second party device, 
regarding use by the second party of any of the personal data of the user; and 

sending information to the user device only if the agreement is reached. 
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18. A system for providing personal data of a user with access rights being controlled 
by the user, the system comprising: 

a user device; 

a trusted party device, the user device being arranged to communicate with the trusted 
party device; 

at least one data storage device including the personal data of the user; 

a rules enforcer included in the trusted party device to enforce rules by which the 
personal data of the user can be accessed by a second party device, the rules having been 
agreed to by the user and a second party associated with the second party device, wherein: 

the at least one data storage device is associated with at least one of the user device 
and the trusted party device. 

19. The system of claim 18, further comprising a plurality of trusted party devices, 
each of the trusted party devices being configured to communicate with at least one other of 
the plurality of trusted party devices, wherein: 

the at least one storage device is included in at least some of the plurality of trusted 
party devices and the personal data of the user is distributed among the at least one storage 
device of at least some of the plurality of trusted party devices. 

20. The system of claim 18, wherein the trusted party device further comprises an 
agreement facilitator to facilitate an agreement between the user and the trusted party. 

21. The system of claim 18, wherein the user device further comprises an agreement 
facilitator to facilitate an agreement between the user and the trusted party. 

22. The system of claim 18, wherein the at least one data storage device has recorded 
therein a service profile within a personal data repository, wherein the service profile includes 
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portions of the personal data of the user and information regarding conditions under which 
items within the service profile can be used by the second party. 

23. The system of claim 18, wherein the trusted party device further comprises a 
history recorder to record a history of actions performed by the user device. 

24. The system of claim 23 , wherein the history recorder includes a level selector by 
which the user, via the user device, can select one of a plurality of levels of a type of the 
actions to be recorded. 

25. A system for providing personal data of a user with access rights being controlled 
by the user, the system comprising 

a user device; 

a second party device, the user device being arranged to communicate with the second 
party device; 

a data storage, associated with the user device, including the personal data of the user; 

and 

a rules enforcer included in the user device to enforce rules by which portions of the 
personal data of the user can be accessed by the second party device, the rules having been 
agreed to by the user and a second party associated with the second party device, the rules 
including what items of the personal data are releasable to the second party and how the items 
of the personal data can be used by the second party. 

26. The system of claim 25, further comprising a service profile stored within the 
data storage, the service profile including portions of the personal data of the user and 
information pertaining to an agreement describing how any of the stored information about 
the user can be used by the second party. 
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27. The system of claim 25, wherein the user device further comprises a history 
recorder to record a history of actions performed by the user device. 

28. The system of claim 27 9 wherein the history recorder includes a level selector to 
select one of a plurality of levels of a type of the actions to be recorded. 

29. A device for providing personal data of a user with access rights being controlled 
by the user, the device comprising: 

a data storage device having recorded therein at least some of the personal data of the 

user; 

an agreement facilitator to facilitate an agreement between the user and a second 
party; and 

a rules enforcer to enforce rules by which items of the personal data of the user can be 
accessed by a second party device, the rules having been agreed to by the user and a second 
party associated with the second party device, the rules enforcer allowing access to only ones 
of the items, which according to the agreement, can be used by the second party. 

30. The device of claim 29, wherein the data storage device has recorded therein a 
service profile within a personal data repository, the service profile including portions of the 
personal data of the user and information regarding conditions under which items of the 
stored personal data of the user can be released to the second party. 

31. The device of claim 30, wherein the service profile is arranged to include 
information regarding a date and a time that any of the stored personal information of the user 
is released to the second party. 

32. The device of claim 30, wherein the service profile is arranged to include 
information pertaining to a contract that describes how any of the stored personal data of the 
user can be used by the second party. 
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33. The device of claim 29 further comprising a history recorder to record a history 
of actions performed by the user. 

34. The device of claim 33, wherein the history recorder includes a level selector by 
which the user can select one of a plurality of levels of a type of the actions to be recorded. 

35. A mobile device for providing personal data of a user with access rights being 
controlled by the user, the mobile device comprising: 

a rules enforcer to enforce the rules by which the personal data of the user can be 
accessed by a second party device, the rules having been agreed to by the user and a second 
party associated with the second party device; 

a data storage device having recorded therein at least some of the personal data of the 

user; 

an agreement facilitator to facilitate an agreement between the user and the second 
party, wherein: 

the data storage device is arranged to have recorded therein a service profile including 
portions of the personal data of the user and information regarding conditions under which 
items within the service profile can be used by the second party. 

36. A machine-readable medium having recorded thereon instructions for a processor 
in a device to perform the steps of: 

receiving an indication regarding which portions of personal data of a user stored in a 
personal data repository are releasable to a second party; 

reaching an agreement, between the user and the second party, regarding use, by the 
second party, of any portions of the personal data in the personal data repository; and 

releasing any of the portions of the stored personal data in the personal data repository 
to the second party according to the agreement, wherein 



BW# 425652 



-30- 



Patent Application Atty. Docket No.: 05288.00013 

NC 17406 

s 

the agreement includes what items within the personal data repository can be used by 
the second party, and 

only ones of the items which, according to the agreement, can be used by the second 
party are released to the second party. 

37. The machine-readable medium of claim 36, further comprising instructions for 
storing of the personal data about the user in a distributed manner, the personal data being 
distributed and stored among a plurality of devices arranged to communicate with one 
another. 

38. The machine-readable medium of claim 36, further comprising instructions for 
allowing the user to perform at least one of adding, deleting or changing the personal data 
about the user. 

39. The machine-readable medium of claim 36, further comprising instructions for 
allowing a defining of a service profile within a personal data repository, the service profile 
including portions of the personal data of the user and information regarding conditions under 
which items of the stored personal data of the user can be released to the second party. 

40. The machine-readable medium of claim 39, wherein the service profile includes 
information pertaining to the agreement between the user and a second party. 

41. The machine-readable medium of claim 36, further comprising instructions for 
recording a history of actions by the user as part of the personal data of the user. 

42. The machine-readable medium of claim 41, further comprising instructions for 
defining, by the user, a level of a type of the actions to be recorded. 
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43. A machine-readable medium having recorded thereon instructions for a processor 
in a device to perform the steps of: 

receiving, by a trusted party device, a request to send information; 

selecting a user device to receive the information based on a willingness to receive the 
information indicated within stored personal data about the user when at least one user device 
has indicated the willingness to receive the information; and 

sending the vendor information to the selected user device when the selected user 
device exists. 

44. A machine-readable medium having recorded thereon instructions for a processor 
in a device to perform the steps of: 

receiving, by a user device from a second party device, a request for at least some of 
the personal data of the user; 

attempting to reach an agreement with a second party, via the second party device, 
regarding use by the second party of any of the personal data of the user; and 

sending vendor information to the user device only if the agreement is reached, 

45. A mobile device for providing personal data of a user with access rights being 
controlled by the user, the mobile device comprising: 

a rules enforcer to enforce the rules by which the personal data of the user can be 
accessed by a second party device, the rules having been agreed to by the user and a second 
party associated with the second party device; 

a data storage device having recorded therein at least some of the personal data of the 

user; 

an agreement facilitator to facilitate an agreement between the user and the second 

party; 

and 
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a history recorder to record a history of actions by the user via the user device, the 
history recorder including a level selector to select a level of the actions to be recorded, 
wherein: 

the data storage device is arranged to have recorded therein at least a portion of a 
service profile including information regarding what portions of the stored personal data of 
the user can be released to the second party and conditions under which the portions of the 
service profile can be released to the second party. 
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